WIN: Windows PowerShell

What Is PowerShell?

PowerShell is a cross-platform task automation solution made up of a command-line shell, a scripting language, and a configuration management framework.

PowerShell is a powerful tool from Microsoft designed for task automation and configuration management. It combines a command-line interface and a scripting language built on the .NET framework.

Unlike older text-based command-line tools, PowerShell is object-oriented, meaning it can handle complex data types and interact with system components more effectively. Initially exclusive to Windows, PowerShell has expanded to support macOS and Linux, making it a versatile option for IT professionals across different operating systems.

Objects in PowerShell

To fully understand PowerShell, you need to understand what an object is in this context.

In programming, an object represents an item with:

• Properties — characteristics (e.g., a file's name, size, extension)
• Methods — actions (e.g., copy a file, stop a process)

In PowerShell, objects are the fundamental units that encapsulate data and functionality. The traditional Command Prompt's basic commands output plain text. When a cmdlet is run in PowerShell, it returns objects that retain their properties and methods, allowing for more powerful and flexible data manipulation without additional text parsing.

Traditional CMD:
  dir -> plain text output -> hard to parse further

PowerShell:
  Get-ChildItem -> object with .Name, .Length, .Extension
                -> pipe to Sort-Object, Where-Object, etc.

Basic Syntax: Verb-Noun

PowerShell commands are known as cmdlets (pronounced "command-lets"). They follow a consistent Verb-Noun naming convention:

• The Verb describes the action.
• The Noun specifies the object on which the action is performed.

Examples:

Discovering Cmdlets

Get-Command

Filter by type or name:

Get-Command -CommandType "Function"
Get-Command -Name Remove*

Getting Help

Get-Help Get-Date
Get-Help Get-Date -Examples

PowerShell Aliases

PowerShell includes aliases to make transition from CMD or Bash easier:

List all aliases:

Get-Alias

Extending PowerShell with Modules

PowerShell can be extended by downloading additional cmdlets from online repositories.

Search for modules in the PowerShell Gallery:

Find-Module -Name "PowerShell*"

Install a module:

Install-Module -Name "PowerShellGet"

File System

Examples

Get-ChildItem -Path "C:\Users"

Set-Location -Path ".\Documents"

New-Item -Path ".\reports\summary" -ItemType "Directory"
New-Item -Path ".\reports\summary\output.txt" -ItemType "File"

Remove-Item -Path ".\reports\summary\output.txt"

Copy-Item -Path .\file.txt -Destination .\file-backup.txt

Get-Content -Path ".\output.txt"

Piping, Filtering, and Sorting

Piping allows the output of one cmdlet to be used as the input for another. Because PowerShell passes objects (not text), the receiving cmdlet can access all properties directly.

Sorting

Get-ChildItem | Sort-Object Length

Filtering with Where-Object

Get-ChildItem | Where-Object -Property "Extension" -eq ".txt"

Comparison Operators

Get-ChildItem | Where-Object -Property "Name" -like "report*"

Selecting Properties

Get-ChildItem | Select-Object Name, Length

Chaining Multiple Pipes

Get-ChildItem | Sort-Object Length -Descending | Select-Object -First 1

Searching File Content

Select-String -Path ".\output.txt" -Pattern "error"

Similar to grep in Linux or findstr in CMD.

System and Network

Real-Time Analysis

These cmdlets are particularly powerful for incident response, performance monitoring, and malware analysis:

# Check all running processes sorted by CPU
Get-Process | Sort-Object CPU -Descending | Select-Object -First 10

# Find established TCP connections
Get-NetTCPConnection | Where-Object -Property "State" -eq "Established"

# Hash a file for integrity checking
Get-FileHash -Path "C:\Windows\System32\ntdll.dll"

Remote Scripting

Invoke-Command is essential for executing commands on remote systems:

# Run a script on a remote server
Invoke-Command -FilePath c:\scripts\test.ps1 -ComputerName Server01

# Run a command on a remote server with credentials
Invoke-Command -ComputerName Server01 -Credential Domain01\User01 -ScriptBlock { Get-Culture }

This makes PowerShell fundamental for system administrators, security engineers, and penetration testers managing distributed environments.

Quick Reference Summary

Discovery:
  Get-Command           - List all cmdlets
  Get-Help <cmdlet>     - Get help for a cmdlet
  Get-Alias             - List all aliases

File System:
  Get-ChildItem         - List files (ls)
  Set-Location          - Change directory (cd)
  New-Item              - Create file/folder
  Remove-Item           - Delete file/folder
  Copy-Item             - Copy file/folder
  Get-Content           - Read file content (cat)

Filtering:
  Where-Object          - Filter by property
  Sort-Object           - Sort results
  Select-Object         - Select specific properties
  Select-String         - Search file content (grep)

System:
  Get-ComputerInfo      - Full system info
  Get-LocalUser         - Local user accounts
  Get-NetIPConfiguration- Network config

Analysis:
  Get-Process           - Running processes
  Get-Service           - Service status
  Get-NetTCPConnection  - TCP connections
  Get-FileHash          - File integrity hash

Remote:
  Invoke-Command        - Execute on remote systems

Summary

PowerShell's object-oriented model sets it apart from traditional CMD. By operating on structured objects rather than plain text, it enables powerful chaining of cmdlets using pipes, filtering, and sorting without any text parsing. Combined with its comprehensive coverage of file systems, networking, process monitoring, and remote execution, PowerShell is the essential tool for modern Windows administration, automation, and security analysis.